feat: do not log secret variables (#2514)

taskfile/ast/cmd.go

@@ -9,7 +9,8 @@ import (
 
 // Cmd is a task command
 type Cmd struct {
-	Cmd         string
+	Cmd         string // Resolved command (used for execution and fingerprinting)
+	LogCmd      string // Command with secrets masked (used for logging)
 	Task        string
 	For         *For
 	If          string
@@ -28,6 +29,7 @@ func (c *Cmd) DeepCopy() *Cmd {
 	}
 	return &Cmd{
 		Cmd:         c.Cmd,
+		LogCmd:      c.LogCmd,
 		Task:        c.Task,
 		For:         c.For.DeepCopy(),
 		If:          c.If,

taskfile/ast/var.go

@@ -8,37 +8,54 @@ import (
 
 // Var represents either a static or dynamic variable.
 type Var struct {
-	Value any
-	Live  any
-	Sh    *string
-	Ref   string
-	Dir   string
+	Value  any
+	Live   any
+	Sh     *string
+	Ref    string
+	Dir    string
+	Secret bool
 }
 
 func (v *Var) UnmarshalYAML(node *yaml.Node) error {
 	switch node.Kind {
 	case yaml.MappingNode:
-		key := "<none>"
-		if len(node.Content) > 0 {
-			key = node.Content[0].Value
+		var m struct {
+			Sh     *string
+			Ref    string
+			Map    any
+			Value  any
+			Secret bool
 		}
-		switch key {
-		case "sh", "ref", "map":
-			var m struct {
-				Sh  *string
-				Ref string
-				Map any
+		if err := node.Decode(&m); err != nil {
+			return errors.NewTaskfileDecodeError(err, node)
+		}
+		// Validate the keys regardless of their order: every key must be known
+		// and at least one type-defining key must be present. "secret" is a
+		// modifier, not a type, so it can appear in any position.
+		hasType := false
+		for i := 0; i+1 < len(node.Content); i += 2 {
+			switch node.Content[i].Value {
+			case "sh", "ref", "map", "value":
+				hasType = true
+			case "secret":
+				// modifier, not a type
+			default:
+				return errors.NewTaskfileDecodeError(nil, node).WithMessage(`%q is not a valid variable type. Try "sh", "ref", "map", "value" or using a scalar value`, node.Content[i].Value)
 			}
-			if err := node.Decode(&m); err != nil {
-				return errors.NewTaskfileDecodeError(err, node)
-			}
-			v.Sh = m.Sh
-			v.Ref = m.Ref
+		}
+		if !hasType {
+			return errors.NewTaskfileDecodeError(nil, node).WithMessage(`a variable must define one of "sh", "ref", "map", "value" or be a scalar value`)
+		}
+		v.Sh = m.Sh
+		v.Ref = m.Ref
+		v.Secret = m.Secret
+		// Handle both "map" and "value" keys
+		if m.Map != nil {
 			v.Value = m.Map
-			return nil
-		default:
-			return errors.NewTaskfileDecodeError(nil, node).WithMessage(`%q is not a valid variable type. Try "sh", "ref", "map" or using a scalar value`, key)
+		} else if m.Value != nil {
+			v.Value = m.Value
 		}
+		return nil
 	default:
 		var value any
 		if err := node.Decode(&value); err != nil {